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WHAT IS CLAIMED IS: 

1 . A method for xise in compliance management, comprising: 
presenting, via a computer network, at least one user with a series of 

questions relating to at least one business category; 

soliciting, via the computer network, a response from the at least one 
user for each question presented; and 

prioritizing, via the computer network, the at least one biisiness 
category based on the at least one user's responses and at least one standard severity 
risk index. 

2. The mediod of claim 1 wherein the user response comprises a "Yes" or 

"No. 

3. The method of claim 1 wherein at the least one standard severity risk 
index comprises a number between 1 and 10 corresponding to a specific level of risk. 

4. The method of claim 3 wherein the number "1" comprises the lowest 
level of risk severity, and the number "10" the highest level of severity. 

5. The method of claim 1 wherein the at least one standard severity risk 
index corresponds to the at least one business category. 

6. The method of claim 1 further comprising the step of determining a 
detection index based on the number of questions presented, the at least one user's 
responses, and the number of visers. 

7. The method of claim 6 further comprising determining an occurrence 
index based on the potential consequences of non-compliance. 

8 . The method of claim 7 wherein the prioritizing step comprises 
determining at least one total risk score based on the detection, occurrence, and 
severity risk indices. 
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9. The method of claim 8 further comprising ranking the at least one 
business category based on the at least one total risk score. 

10. A system for use in compliance management, comprising: 

a query module associated with an engine for presenting at least one user with 
5 a series of questions relating to at least one business category, and for soliciting and 
receiving responses from the at least one user for each question presented; 

a prioritization module associated with the engine for prioritizing the at least 

b one business category based on the at least one user' s responses and at least one 

O 

SI standard severity risk index. 

¥ \0 11. The system of claim 10 wherein the series of questions are presented to 

iin the user over a communications networic. 

12. The system of claim 10 further comprising an administration module 
rU associated with the engine for inputting, updating and accessing data associated with 
□ the query and prioritization modules, the administration module being accessible to an 
^ 1 5 administrator of the system via an administration interface. 

1 3 . The system of claim 1 0 wherein the user response comprises a "Yes" 
or "No" response. 

14. The system of claim 1 0 wherein the at least one standard severity risk 
index comprises a number between 1 and 10 corresponding to a specific level of risk. 

20 15. The system ofclaim 14 wherein the number "1" comprises the lowest 

level of severity, and the number "10" the highest level of severity. 

1 6. The system of claim 1 0 wherein the at least one standard severity risk 
index corresponds to the at least one business category. 

1 7. The system of claim 1 0 wherein the prioritization module further 

25 determines a detection index based on the number of questions presented, the at least 
one user's responses, and the number of users. 
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1 8 . The system of claim 1 7 wherein the prioritization module further 
determines an occurrence index based on the potaitial consequences of non- 
compliance. 

19. The system of claim 1 8 wherein the prioritization module fiirfher 
determines at least one total risk score based on the detection, occurrence, and 
severity risk indices. 

20 . The system of claim 1 9 wherein prioritization module further ranks the 
at least one business category based on the at least one total risk score. 
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